CODEWITHSUNDEEP
amazon-web-servicesamazon-cognito
scottmont
scottmont

Reputation: 39

How can I listUsers in Cognito from another account

Try to use cognitoIdentityService.listUsers with a role running ec2 machine and it works great in the local org (orgA). I also want the same role to listUser in another org (orgB).

I created a a role with trust in the orgB with orgA in the Trust relationship and gave it Cognito permissions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::xxxxxxxxxxxx:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Then in orgA i added an inline policy to the role i want to give access

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": "arn:aws:iam::xxxxxxxxxxxx:role/orgBCognitoAccess"
    }
}

I pass the REGION and USERPOOLID to my function.

    const params = {
      "UserPoolId": UserPoolId,
      "Filter": `email = \"${email}\"`,
      "Limit": 1
    }

    cognitoIdentityService.listUsers(params, (err, data) => {

But all i get in return is an error. Should it be switch roles when it sees the userpool does not exist? Is that logic I have to write in or can it be done at all?

 {"message":"User pool ca-central-1_BBBBBBBB does not exist.","code":"ResourceNotFoundException","time":"2021-01-18T18:01:29.279Z","requestId":"acc14424-9f1d-411a-95f2-1a302e5773f8","statusCode":400,"retryable":false,"retryDelay":21.27495199615266}

Thanks

Upvotes: 0

Views: 277

Answers (1)

samtoddler
samtoddler

Reputation: 9635

Yes, you have given permissions and everything to the roles, but you are still using role in OrgA, so to make the API call you to have to switch role in OrgB and use those credentials for making the client and eventually make the call.

sts_client = boto3.client('sts')

# Call the assume_role method of the STSConnection object and pass the role
# ARN and a role session name.
assumed_role_object=sts_client.assume_role(
    RoleArn="arn:aws:iam::account-of-role-to-assume:role/name-of-role",
    RoleSessionName="AssumeRoleSession1"
)

# From the response that contains the assumed role, get the temporary 
# credentials that can be used to make subsequent API calls
credentials=assumed_role_object['Credentials']

# Use the temporary credentials that AssumeRole returns to make a 
# connection to Amazon S3  
s3_resource=boto3.resource(
    's3',
    aws_access_key_id=credentials['AccessKeyId'],
    aws_secret_access_key=credentials['SecretAccessKey'],
    aws_session_token=credentials['SessionToken'],
)

# Use the Amazon S3 resource object that is now configured with the 
# credentials to access your S3 buckets. 
for bucket in s3_resource.buckets.all():
    print(bucket.name)

you can find more details in the documentation

To verify this during the testing you can make GetCallerIdentity this gives you enough details.

{
    "UserId": "AIDASAMPLEUSERID",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/DevAdmin"
}

Upvotes: 2

Related Questions